News for hackers. Stuff that matters.

A comment on Mozilla fixes Firefox zero-day actively exploited in attacks. Parent comment

Re:Mozilla fixes Firefox zero-day actively exploited in attacks by tomrittervg on Friday October 11, 2024 @08:21AM (#41808849)
The vulnerability did require JavaScript to trigger.

I think it would be a labor of love and craftsmanship to exploit a content process today without using JavaScript.

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by jjuran on Friday October 11, 2024 @10:28AM (#41809773)
> The vulnerability did require JavaScript to trigger.

Can you back this up with a citation?

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by a_vanderbilt on Tuesday October 15, 2024 @08:53PM (#41854617)
He works (or recently worked) for Mozilla on security-related projects. The code commit fixing the issue was isolated to the /dom/ directory in the source tree, and Firefox does not support CSS Animation Timelines. The Animation Timelines code is not directly accessed by web devs, and it appears the only way to execute that code is via the JS API for Animation Timelines. I'm not a web security expert, but the signs seem to point to him being correct.

Once again, JS proves to be a security risk.

[ Parent | on HN ]